mims-harvard ToolUniverse up to 1.2.6 Python Executor python_executor_tool.py sandbox

Summaryinfo

A vulnerability classified as critical has been found in mims-harvard ToolUniverse up to 1.2.6. This issue affects some unknown processing of the file python_executor_tool.py of the component Python Executor. Performing a manipulation results in sandbox. This vulnerability was named CVE-2026-81096. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in mims-harvard ToolUniverse up to 1.2.6. It has been classified as critical. This affects some unknown processing of the file python_executor_tool.py of the component Python Executor. The manipulation with an unknown input leads to a sandbox vulnerability. CWE is classifying the issue as CWE-265. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-81096 since 08/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1611 for this issue.

Upgrading to version 1.3.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• mims-harvard

Name

• ToolUniverse

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion